From: Patrick McHardy Date: Mon, 16 May 2011 12:42:26 +0000 (+0200) Subject: netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages X-Git-Tag: Ubuntu-5.10.0-12.13~24399^2~48^2~3^2~1 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=274ea0e2a4cdf18110e5931b8ecbfef6353e5293;p=mirror_ubuntu-hirsute-kernel.git netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages Verify that the message length of a single SIP message, which is calculated based on the Content-Length field contained in the SIP message, does not exceed the packet boundaries. Signed-off-by: Patrick McHardy --- diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index bcf47eb518ef..1f81abde131f 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, end += strlen("\r\n\r\n") + clen; msglen = origlen = end - dptr; + if (msglen > datalen) + return NF_DROP; ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen); if (ret != NF_ACCEPT)